Sophos[.]exe | Triage™

General

Target
Sophos.exe
Size 12.4MB
Sample261110-prrm8aav3n
SHA256 6d361e4155397f370ba0d485c737d4680a32a9e5698a8da4474f69d203b830fa
MD5 5e676c9e669e11957ac919c22a298a49
SHA1 3c79db0a1bf5e5c4a6985b9903ae7ed4c4dac2ce
SHA512 1b1330adaf692db72a61bdf8e7f0d7e65b95f113ff3958ccc0dee169bf1b6326969efe5999f250e71a0bfcc53b0f75e317275037f8a952c6850852b09219b9a2
SSDEEP 393216:SGGc4aRMnrN1CZBwwPIE05gpZ+YmcQfKDqMz3PC+EwOpAIgxb/KNREH283DEQopT:SGGc4aRMnrN1CZBwwPIE05gpZQcQfKD0
TLSH
T1ECD6E823EFA06805F26B14315996176E08222C75D0197D4BB7C3AE2A2D71EC3DDF936B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Sophos.exe

File Explorer

Sophos.exe

.exe 12.4MB

Sophos.exe

IMPHASH 80809256d81722b2e2330ed28370322b
SHA256 6d361e4155397f370ba0d485c737d4680a32a9e5698a8da4474f69d203b830fa
MD5 5e676c9e669e11957ac919c22a298a49
SHA1 3c79db0a1bf5e5c4a6985b9903ae7ed4c4dac2ce
SHA512 1b1330adaf692db72a61bdf8e7f0d7e65b95f113ff3958ccc0dee169bf1b6326969efe5999f250e71a0bfcc53b0f75e317275037f8a952c6850852b09219b9a2
SSDEEP 393216:SGGc4aRMnrN1CZBwwPIE05gpZ+YmcQfKDqMz3PC+EwOpAIgxb/KNREH283DEQopT:SGGc4aRMnrN1CZBwwPIE05gpZQcQfKD0
TLSH
T1ECD6E823EFA06805F26B14315996176E08222C75D0197D4BB7C3AE2A2D71EC3DDF936B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

62976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTextTstLe __vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 __vbaVarTextCmpGe _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaFreeVar ord588 __vbaLineInputStr __vbaLateIdCall __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 __vbaFreeObjList ord516 __vbaVarTextTstLt __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaVarTextCmpGt ord519 __vbaResume __vbaVarCmpNe __vbaStrCat ord552 __vbaError __vbaVarTextTstEq __vbaLsetFixstr ord553 ord660 __vbaSetSystemError __vbaStrDate ord661 ord662 __vbaHresultCheckObj ord557 ord558 __vbaLenVar _adj_fdiv_m32 __vbaVarTstLe __vbaAryDestruct __vbaVarCmpGe __vbaLateMemSt ord591 ord592 __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord300 ord301 __vbaStrLike __vbaObjSet ord595 __vbaOnError ord302 _adj_fdiv_m16i ord303 ord702 __vbaObjSetAddref _adj_fdivr_m16i ord304 ord598 ord305 __vbaFpR4 ord599 ord306 __vbaStrFixstr __vbaBoolVar ord520 ord307 ord521 ord308 __vbaStrTextCmp ord522 ord309 ord523 __vbaFpR8 __vbaVarTstLt __vbaBoolVarNull _CIsin ord631 ord709 __vbaVargVarMove ord525 __vbaVarCmpGt __vbaNextEachCollObj ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 ord529 __vbaExitEachColl __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaR4Str __vbaDateR8 ord560 __vbaVarLikeVar __vbaPrintObj __vbaI2I4 ord561 DllFunctionCall ord563 __vbaVarLateMemSt __vbaVarOr __vbaCastObjVar __vbaRedimPreserve __vbaStrR4 _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew __vbaVarTextTstNe ord600 __vbaUI1I2 _CIsqrt ord310 __vbaLateIdCallSt __vbaVarAnd ord311 EVENT_SINK_QueryInterface __vbaVarTextCmpEq __vbaVarMul __vbaExceptHandler ord312 ord313 __vbaStrToUnicode __vbaPrintFile ord712 __vbaR4ErrVar ord606 __vbaDateStr _adj_fprem _adj_fdivr_m64 ord714 __vbaVarDiv ord607 __vbaR8ErrVar __vbaI2Str __vbaLateIdStAd ord608 ord716 __vbaVarCmpLe __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal ord534 __vbaVarCat ord535 __vbaDateVar __vbaLsetFixstrFree ord536 __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaR8Str __vbaInStr __vbaNew2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaVarNot __vbaFreeStrList __vbaVarTextTstGt _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq ord610 __vbaLateMemCall __vbaAryLock __vbaVarAdd __vbaStrToAnsi ord612 __vbaFreeVarg __vbaVarDup ord613 __vbaVerifyVarObj __vbaFpI2 __vbaVarMod __vbaVarLateMemCallLd ord616 __vbaFpI4 __vbaVarCopy __vbaVarTstGe __vbaR8IntI2 __vbaLateMemCallLd ord617 _CIatan ord618 __vbaAryCopy __vbaI2ErrVar __vbaCastObj __vbaStrMove __vbaStrVarCopy __vbaR8IntI4 ord619 ord542 ord650 _allmul __vbaLateIdSt __vbaLateMemCallSt __vbaVarTextCmpNe ord545 _CItan ord546 __vbaUI1Var __vbaFPInt __vbaAryUnlock __vbaVarForNext __vbaFpCSngR8 _CIexp __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing